Beveiligingsadvies

CVE-2024-5616

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2024-07-06 08:38:02

Laatst bijgewerkt 2024-08-01 21:18:06

Toegewezen door @huntr_ai

CVSS-score 4.3

Status PUBLISHED

Beschrijving

A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview', without the victim's consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality.

← Alle CVE's bekijken Bekijk op cve.org ↗